Support for OAuth 2.0 has been introduced in the Pulseway RMM for Customers utilizing an Office 365 mailbox as their Outbound ID for email notifications. This is in response to Microsoft's lifecycle announcement, in which they indicate that they will begin deprecating Basic Authentication. When using the Basic/Legacy Authentication, the application sends a username and password with every request, and the Exchange service account is granted access to relevant mailboxes using the Application Impersonation role. With Modern Authentication, full access to all mailboxes permission is granted to the RMM application as part of the consent flow. Modern Authentication is based on the OAuth 2.0 protocol which is a token-based authentication, this design ensures that your global administrator credentials are never stored in RMM for mail parsing.
With token-based authentication, users would enter their username and password to get a token. This token provides access to the resource for a specific time period. The token is auto-renewed as long as the credentials entered in the parser settings are still valid.
Setup in Azure
To connect your Mailbox using OAuth 2.0 in the Pulseway RMM you will have set up the RMM App in your Azure Portal. Login to https://portal.azure.com using your global administrator credentials.
(1) App Registration
Refer to the below steps/screenshots to register the app -
On your Home page, Under Azure services, Click on Azure Active Directory
Under Manage on the left-hand navigation menu, Choose App Registrations > New registration
Register an Application, provide a name
Supported account types: Option 2, Accounts in any organizational directory (Any Azure AD directory - Multitenant)
As we are not performing any Oauth authentication on the RMM interface we don’t need to fill the redirect URI
Copy the Application (client) ID and Directory (tenant) ID from the screen and save them on your notepad
We will now need to provide Authentication and give API permissions for this app registration in order to access the mailboxes
Under Manage on the left-hand navigation menu, Choose Authentication
Select Yes to Enable the following mobile and desktop flows
(3) API Permissions
On the left-hand side under Manage, Navigate to API Permissions
Add the permission
On the Request API permission screen Select Microsoft Graph
In Graph API choose Delegated permissions
Permissions needed here are
Click on Grant admin consent for a user and the status for all these permissions will be set to green.
Setup in Pulseway RMM
Important! Oauth 2.0 does not support MFA-enabled accounts. Microsoft Graph API does not support this.
Set up the email parser for office 365 under Server Admin > Settings > Email > Server Settings > OAuth . In the OAuth tab, enter the Application ID and Directory ID you saved during App registration earlier.
Save and Test your connection.
Upon successful connection, Basic authentication can be turned off. With Basic Authentication, the parser uses a username and password every time it tries to download an email. With Modern Authentication, the parser will present a token for the session instead of a username and password. With the combination of credentials stored, the Application ID and Directory ID parser will generate a token from O365, and the email dispatch activities will be done based on the token. The system will auto-generate a new token when it expires.